5695ccb9dc8db67b61a15742dcc3a4c1efe945be2f11c25a88cbf78513e3f2b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5695ccb9dc8db67b61a15742dcc3a4c1efe945be2f11c25a88cbf78513e3f2b9
Size

184KB
Sample

221206-l6p66agd35
MD5

7ed15306689a6ce28d857a696fa28550
SHA1

749f3e283781ea263a5f15136455e49ac72db652
SHA256

5695ccb9dc8db67b61a15742dcc3a4c1efe945be2f11c25a88cbf78513e3f2b9
SHA512

dc77a6b22f8cc8d48fce8f21239dc8f6e460748443ca98331afaee09d48f9f9f8ea90de5bd191678af45c27a4f75435b2b82016c3cc029d84d1c69001fac4027
SSDEEP

3072:A35if+jskj+la75P/0F5lQ5Qz8hNi4yaGCERgzvOP:siGbwa75Ps5KQzkNfJP6P

Score

6^/10

persistence

Malware Config

Targets

- Target
  
  5695ccb9dc8db67b61a15742dcc3a4c1efe945be2f11c25a88cbf78513e3f2b9
- Size
  
  184KB
- MD5
  
  7ed15306689a6ce28d857a696fa28550
- SHA1
  
  749f3e283781ea263a5f15136455e49ac72db652
- SHA256
  
  5695ccb9dc8db67b61a15742dcc3a4c1efe945be2f11c25a88cbf78513e3f2b9
- SHA512
  
  dc77a6b22f8cc8d48fce8f21239dc8f6e460748443ca98331afaee09d48f9f9f8ea90de5bd191678af45c27a4f75435b2b82016c3cc029d84d1c69001fac4027
- SSDEEP
  
  3072:A35if+jskj+la75P/0F5lQ5Qz8hNi4yaGCERgzvOP:siGbwa75Ps5KQzkNfJP6P
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2